About Vivekmishra01

Vivekmishra01 · ‎04-03-2023

@gcusello It worked for me for up to last 48 hours. But as I am increasing the time I see some inconsistencies in data. I believe splunk logs are dropping or something like that. Can you explain me below why you did it like that. stats dc(kind) AS kind_count values(marksObtained) AS marksObtained BY demo_id | where kind_count=2

Vivekmishra01 · ‎03-28-2023

I am trying to count number of "A", "B" and "C". So, I think it must be BY "marksObtained". demo_id will be more than 10000.

Vivekmishra01 · ‎03-28-2023

@yeahnah Outer query result will be like below and this is demo_id="64236fa4c43595ajj4eudhjjsh344,0ohf430765235178" {"log":"2023-03-28 22:52:20.504 INFO [my-application-web,64236fa4c43595ajj4eudhjjsh344,0ohf430765235178] 1 --- [nio-1892-exec-4] j.c.o.m.t.c.NotificationEventsController : Two Strings marksObtained=A, ,"Kubernetes.node":"sample-node","Kubernetes.pod":"sample-pod","Kubernetes.namespace":"ABC","hostname":"demo_name"} Inner query Result {"log":"2023-03-28 22:50:14.534 INFO [my-application-web,64236fa4c43595ajj4eudhjjsh344,0ohf430765235178] 1 --- [nio-1892-exec-4] c.j.c.o.m.t.s.AlertsKafkaProducer : Success work done","Kubernetes.node":"sample-node","Kubernetes.pod":"sample-pod","Kubernetes.namespace":"ABC","hostname":"demo_name"} marksObtained will have only three value "A", "B" and "C"

Vivekmishra01 · ‎03-28-2023

@yeahnah The inner subquery don't have "marksObtained" but both the query has common field demo_id

Vivekmishra01 · ‎03-28-2023

I am trying to run a query like below but I am limited to 10000 sub search result. Is there a way to make this query run for more than 10000 sub search result. search index="sample_index" "Kubernetes.namespace"="ABC" "Two String" [index="sample_index" "Kubernetes.namespace"="ABC" "Success work done" | fields demo_id ] | stats count as Result by marksObtained I saw someone has already asked a similar question here, and I tried implementing it in the same way, but it's not working for me. Below is the query which I wrote, but results are not as expected. index="sample_index" "Kubernetes.namespace"="ABC" ("Two String" OR "Success work done") | stats count as Result by marksObtained

Vivekmishra01 · ‎03-10-2023

This is not exactly what I was looking for, but it helped. "appendpipe" exactly gave me what I was looking for. Thanks.

Vivekmishra01 · ‎03-09-2023

I want to add new row to my search result using values from the previous result. Basically I am counting few strings and I want to display percent of that matched string in a new row using some mathematical operators or function. Below is what I have done. My first query works fine but second query in append is giving error. Error is: Error in 'eval' command: The expression is malformed. Expected AND. index="12345" "Kubernetes.namespace"="testnamespace" | bin _time | stats count(eval(searchmatch("String1"))) AS Success count(eval(searchmatch("string2"))) AS Sent count(eval(searchmatch("string3"))) AS Failed | append [ stats eval Success_percent= Success/(Success+Sent +Failed) AS Success eval Sent_Percent= Sent/(Success+Sent +Failed) AS Sent eval Failed_percent= Failed/(Success+Sent +Failed) AS Failed ] | transpose 0 column_name="Status" | rename "row 1" as Count | rename "row 2" as "Percent"

Vivekmishra01 · ‎01-10-2023

I am trying to find few strings in my search query and count occurrences of them and I want to put them in a two column table. I am able to do it with stat command, but it's coming like string as column name and count in the row bwlow. Below is what I am using and what I ma getting. index=<index> <search String > "Failed" | stats count AS Failed count(eval(searchmatch("Failed Acknowledged"))) AS "Failed Acknowledged" count(eval(searchmatch("UnexpectedException Caught"))) AS "UnexpectedException Caught" count(eval(searchmatch("NonRetryableException Caught"))) AS "NonRetryableException Caught" However I want a result like below. Can anyone help? Thanks in advance.

Posts	8
Solutions	0
Karma Given	3
Karma Received	1
Member Since	‎01-10-2023

Online Status	Offline
Date Last Visited	‎04-03-2023 10:25 AM

How to increase subsearch limit?

Adding a new row in stats using values from previo...

Count occurrences of string and put them in table ...

Re: How to increase subsearch limit?

Re: How to increase subsearch limit?

Re: How to increase subsearch limit?

Re: How to increase subsearch limit?

How to increase subsearch limit?

Re: Add a new row in stats using values from previ...

Adding a new row in stats using values from previo...

Count occurrences of string and put them in table ...